Authorization Is the Last Layer Companies Still Build From Scratch
Authentication got outsourced a decade ago. Authorization — the logic that decides what a user can see, edit, or delete — is still built in-house at most companies. AI agents make that unsustainable.
Authorization as a service barely existed five years ago. Authentication got handed off to Auth0 and Okta a decade back. But authorization — the logic that decides what a user can see, edit, or delete inside your app — is still built from scratch at most companies. That’s starting to change, driven by the cost of keeping homegrown systems alive and the growing demand for fine-grained access control from enterprise customers.
On episode 89, Graham Neray, co-founder and CEO of Oso, explained why.
Why authentication got outsourced but authorization didn’t
A decade ago most companies built login from scratch. Then OpenID Connect and SAML matured, Auth0 launched, Okta scaled, and the problem became standard enough to hand off. Authorization followed none of that path. “Permissions are still fundamentally broken out in the world,” Neray said. The core challenge: permission checks happen at many levels — frontend, backend API handlers, database queries — and in a microservices setup the data you need for a check might live in a completely different service.
Authentication asks one question: is this person who they say they are? Authorization asks a different question for every action, against every resource, with logic unique to each app’s data model. The RBAC vs. ABAC distinction matters here — role-based control assigns permissions through fixed roles, attribute-based control looks at changing properties like department or resource sensitivity, and most real apps need a mix, which makes building from scratch even harder.
The real cost of homegrown permissions
Every growing SaaS company hits the same turning point. The first setup — a few role checks hard-coded into the API — works at 10 customers. By 100, edge cases pile up. By 1,000, it eats engineering time that should go toward the product. “Everyone has built this sort of thing from scratch,” Neray said. “Band-aid, band-aid, band-aid. And then everyone does a big refactor.”
The costs are specific: companies often put six or more engineers on homegrown authorization full-time — roughly $1.5 million a year on a system that isn’t the product; adding a new role can take a week or a sprint instead of a minute; and each patch makes the next change harder. Neray frames the build-vs-buy decision the way the rest of the infrastructure stack already settled it: “AWS, Twilio… have normalized the idea that if the thing isn’t making your beer taste better, you should consider buying it instead of building it.”
When fine-grained control becomes a business requirement
The trigger to rethink permissions usually isn’t a security incident — it’s a sales deal. “Usually the driver to adopt Oso is about a company moving up market,” Neray said. “They want to sell to the federal government. In order to do that, they need fine-grained access control.” Fine-grained control goes beyond broad roles, checking a user’s relationship to the specific resource, their attributes, and the request context for precise, real-time decisions.
Slack shows the cost of solving this alone. Around 2018, launching Enterprise Grid to move up market, it needed the ability to say one user owns a particular channel while another owns a different one. No off-the-shelf service existed, so Slack spent millions building a custom system. Allan Leinwand, who approved that project, later became CTO of Webflow — and when Webflow hit the same point, he chose to buy rather than build again.
Authorization as a growth engine
Most security purchases reduce risk. Authorization is different — the feature itself is what enterprise customers pay for. When a product adds fine-grained controls, it opens deals that weren’t possible before. As our co-founder Sasha Sinkevich put it on the show: “The value add from a SIEM is very different than the value add from a security control that enables your growth.” And Jon McLachlan captured the bigger idea: “If you can actually position security to be your market distinguisher, your secret weapon, you’re going to get more of those deals, the bigger ones, the ones that are more sticky and care deeply about security.” That’s precisely the posture behind turning security into a sales asset.
The AI dimension
AI agents make the problem urgent. Every company adding agents must answer: what can this agent do, and on whose behalf? Traditional role-based systems can’t answer that on the fly — an agent’s task changes every run, and it can be tricked in ways humans can’t. “If you want to add agents to your product, you basically have to figure this out,” Neray said. Companies building authorization from scratch today will face the problem twice — once for human users, again for agents that need least privilege. The ones that bring in a real authorization layer now solve both with one investment.